What is Black Basta Ransomware?

Black Basta Ransomware

malware OpenTrojan Threat Intelligence Updated 2026-08-26

Critical infrastructure and enterprises; double extortion

Source Attribution

Origin: MITRE
Source: CISA advisory AA22-281A · MITRE ATT&CK
Reviewer: Phase 44E review
Verified: 2026-08-26T15:16:26.825Z
Confidence: high

Source: CISA advisory AA22-281A · MITRE ATT&CK · Verified: 2026-08-26T15:16:26.825Z · Confidence: high

Security Timeline

2022-04 discovered Black Basta first observed
2022-10 updated CISA advisory AA22-281A published

Quick Answer

Black Basta affiliates gain access via QakBot or phishing, use Windows tools (PsExec, RDP) for lateral movement and deploy custom encryption plus a leak site.

Definition

Black Basta is a RaaS that rapidly encrypts systems and applies double extortion, with observed links to QakBot initial access and CVE exploitation.

Overview

Black Basta is a RaaS that rapidly encrypts systems and applies double extortion, with observed links to QakBot initial access and CVE exploitation.

Behavior

QakBot-linked initial access
Custom encryption via journal NTFS feature
Open leak site for double extortion

First Seen

2022-04

Target

Critical infrastructure and enterprises; double extortion

Techniques: T1486, T1078, T1562
Campaigns: n/a
Related CVEs: CVE-2021-40444, CVE-2021-34527

Malware Intelligence

Family: Black Basta Ransomware

Aliases: Black Basta

Techniques: T1486, T1078, T1562

Targets: Critical infrastructure and enterprises; double extortion

Behavior:

QakBot-linked initial access
Custom encryption via journal NTFS feature
Open leak site for double extortion

References

Have a follow-up question?

Ask OpenTrojan's evidence-backed assistant about this topic — answers cite their sources.

Ask AI about this Start an investigation

Start Investigation

Move from reading to investigating Black Basta Ransomware. The workspace is a structured analysis surface — not a chat — organised as:

Question — what do you need to know about Black Basta Ransomware?

Evidence — assertions mapped to verifiable references.

Timeline — events in chronological order.

Related Entities — CVE, threat actor, campaign, malware links.

Sources — NVD, CISA KEV, MITRE ATT&CK, vendor advisories.

Notes — your own observations and working hypotheses.

AI assistance is limited to summarising, explaining, and suggesting related evidence. AI never completes your investigation, modifies entity relationships, or generates facts — all published analysis stays human-reviewed.